Privacy policy

1. Who is responsible

The controller for this website is Takeaway Reality d.o.o., Trg Luke Ilića – Oriovčanina 8, 44330 Novska, Croatia, OIB (personal identification number) 26498945933, company registration number (MBS) 05912326.

For any privacy question, write to [email protected].

2. What this policy covers

This policy covers the Nexos.hr website only. When an employer uses the Nexos.hr app for its employees, the employer is the controller for that data and we process it on the employer's behalf under a data processing agreement (Art. 28 GDPR). Employees should contact their employer about that processing.

3. Visiting the website

When you open a page, our hosting provider automatically records technical data in server logs:

• IP address
• date and time of the request
• page requested and referring page
• browser type and operating system

We use this data only to deliver the website, keep it secure and find errors. The legal basis is our legitimate interest in running a safe website (Art. 6(1)(f) GDPR). Logs are deleted after 14 days unless we need them to investigate a security incident.

4. Contact form and email

When you use the contact form or write to us, we process your name, work email address, your message and the language of the page you used.

We use this data to answer you and to arrange a demo. The legal basis is taking steps at your request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR).

We keep enquiries for up to 12 months after our last contact, unless they lead to a customer relationship, in which case the retention periods of that contract apply.

Giving us this data is voluntary, but without a name and email address we cannot reply.

5. Cookies and tracking

This website does not currently use any tracking or advertising cookies and does not track you across other websites. Fonts and images are served from our own server, so no data is sent to third parties such as font providers when you load a page.

When you choose Accept or Decline in the cookie banner, your browser stores that choice locally (key "nexos-consent") so we do not ask again. This is strictly necessary to respect your choice and is not shared with anyone. You can change your choice at any time via "Cookie settings" at the bottom of every page.

When you open the homepage, we show the language version for your country, based on the country our network provider Cloudflare derives from your IP address. The IP address is not stored for this. If you pick a language in the language menu, we set a cookie ("nexos_lang", valid for one year) so we do not redirect you again. It is strictly necessary to remember the language you asked for and contains nothing else.

If we add optional tools such as anonymous visit statistics in the future, they will only run after you accept (Art. 6(1)(a) GDPR), and we will list them here.

6. Who receives your data

We only share data with service providers that help us run this website, bound by data processing agreements under Art. 28 GDPR:

• website hosting: Microsoft Azure, in a data centre in the EU (Microsoft Ireland Operations Ltd., Ireland)
• contact form delivery: Azure Communication Services, data processed in Europe (Microsoft Ireland Operations Ltd., Ireland)
• email: Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland)
• network, security and DNS: Cloudflare, Inc. (USA), which passes all requests to the website on to Microsoft Azure

Our data is hosted in the European Union. If a provider processes data outside the EU or EEA, we make sure appropriate safeguards are in place, such as an adequacy decision or the EU Standard Contractual Clauses. For Cloudflare this is the EU-US Data Privacy Framework and the Standard Contractual Clauses.

We do not sell personal data and do not use it for automated decision-making or profiling.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have incorrect data corrected (Art. 16)
• have your data deleted (Art. 17)
• restrict how we process it (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on our legitimate interest (Art. 21)

To use any of these rights, write to [email protected]. We answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe the problem occurred. In Croatia this is the Personal Data Protection Agency (AZOP), in Slovenia the Information Commissioner, in Austria the Data Protection Authority, in Switzerland the FDPIC, and in Germany the data protection authority of the relevant federal state.

8. Security

The website is served only over an encrypted connection (HTTPS). Access to enquiries is limited to the people at Nexos.hr who need it to answer you.

9. Changes to this policy

We update this policy when the website or the law changes. The date at the top shows the latest version.